325 questions total · 5pages · All types, answers revealed
Page 1 of 5
Page 2When setting up Argo CD, which TWO components are essential to define a GitOps workflow?
AppProject is used to logically group applications and enforce security boundaries.
Why this answer
An Application object defines the source and destination, and a Project organizes them.
What is the purpose of the 'destination' field in an Argo CD Application manifest?
This is the required definition for the target environment.
Why this answer
The 'destination' field specifies the Kubernetes cluster (server) and namespace where the application resources should be applied.
Which THREE of the following are core requirements for adopting a GitOps-based workflow?
Essential for defining the desired state.
Why this answer
GitOps requires a declarative state in Git, an automated agent, and an immutable history.
You are deploying applications across multiple clusters using Argo CD. You want to implement a hub-and-spoke model where the central management cluster controls all edge clusters. Which THREE of the following are necessary to correctly configure this pattern?
The hub cluster must have sufficient RBAC permissions to manipulate resources on the spokes.
Why this answer
The hub-and-spoke pattern relies on cluster secrets, target cluster definitions, and proper project isolation.
Which TWO of the following are core principles of GitOps?
This is a core pillar of GitOps.
Why this answer
Declarative state and automated, continuous reconciliation are the foundational pillars of the GitOps methodology.
Which THREE of the following are potential risks of ignoring drift in a GitOps environment?
If drift is not fixed, the Git repo stops representing reality.
Why this answer
Ignoring drift leads to configuration loss, security gaps, and deployment failures.
In the context of GitOps, what is 'Configuration Drift'?
This is the standard definition of drift.
Why this answer
Drift occurs when the actual state of the infrastructure or application in the cluster deviates from the intended state defined in Git.
When implementing DevSecOps within a GitOps workflow, where should the automated policy enforcement (like OPA/Gatekeeper) occur?
Admission controllers evaluate resources at the point of creation, providing a final security gate regardless of how the manifest was deployed.
Why this answer
Policy enforcement should happen during the admission control phase of the Kubernetes API to ensure all resources, including those managed by GitOps, comply.
What does the term 'Self-Healing' mean in a GitOps context?
This is the core functionality of a GitOps operator.
Why this answer
Self-healing refers to the operator's ability to revert manual changes back to the state defined in Git.
What is the primary benefit of a 'pull' deployment model compared to a 'push' model in GitOps?
The operator initiates outbound connections, making the cluster more secure.
Why this answer
Pull-based models eliminate the need to open inbound firewall ports or expose credentials to external services.
What is the role of a 'Webhook' in a GitOps setup?
Webhooks reduce latency by pushing notification of commits.
Why this answer
Webhooks allow the Git provider to notify the GitOps operator immediately when a change occurs, rather than waiting for the next polling interval.
Which of the following is considered an 'Anti-pattern' in a GitOps workflow?
This creates 'configuration drift' and bypasses version control.
Why this answer
GitOps requires that the Git repository is the sole source of truth; any manual 'hotfixing' via kubectl overrides the versioned state and creates drift.
When configuring a GitOps tool, what is the purpose of a 'webhook' in relation to the Git repository?
This optimizes the poll interval and reduces latency.
Why this answer
Webhooks allow the Git server to notify the GitOps controller that a change has occurred, triggering an immediate sync check.
You notice your GitOps operator is performing too many API calls to the Kubernetes API server. What is the most likely configuration issue?
Frequent polling creates heavy traffic on the K8s API server.
Why this answer
An aggressive sync interval or a very large number of managed resources without caching can cause excessive API load.
Which of the following best describes the 'Declarative' principle in GitOps?
Declarative systems define the 'what' rather than the 'how'.
Why this answer
Declarative means defining the end state of the system, rather than the sequence of commands to reach that state.
When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?
This CLI tool tests policies against resources.
Why this answer
The 'kyverno apply' command allows testing a policy against a local manifest to verify compliance before deployment.
Which TWO are common strategies for GitOps repo structure?
Standard for managing multi-environment configs.
Why this answer
Common strategies include 'App-of-Apps' for managing nested dependencies and 'Directory-per-Environment' for separating configurations.
When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?
AppProject controls which repositories and namespaces are accessible by specific applications.
Why this answer
The AppProject resource acts as a logical grouping for Applications, allowing administrators to restrict where they can be deployed and which resources are permitted, providing multi-tenant security.
What is the purpose of a 'Kustomization' resource in a GitOps workflow?
Kustomization is a tool for managing variations of Kubernetes configurations.
Why this answer
Kustomization allows for templating and patching Kubernetes manifests for different environments without changing the base code.
Why must the desired state be 'versioned' in Git in a GitOps architecture?
Versioning provides a history of states that can be redeployed at any time.
Why this answer
Version control allows for easy rollbacks, audit trails, and consistent releases across environments.
In ArgoCD, what does the 'Revision' field in an Application manifest represent?
Revision points to the exact state in Git.
Why this answer
The 'Revision' field specifies the Git commit hash, tag, or branch that the application is currently synced to.
What is the purpose of a 'Sync Window' in Argo CD?
This allows teams to prevent deployments during peak hours or maintenance windows.
Why this answer
Sync windows restrict when automated syncs are allowed, preventing deployments during sensitive times.
Which THREE of the following are necessary to prevent 'Secret Sprawl' in a multi-cluster environment? (Select three)
This limits the blast radius of secrets.
Why this answer
To prevent secrets from being exposed everywhere, you should use tools like External Secrets, namespace-scoped secrets, and avoid putting sensitive data directly into the Git repository.
When using Argo CD, how do you handle applications that require resources to be created in a specific order (e.g., CRDs before Operators)?
SyncWaves explicitly control the order of execution.
Why this answer
Argo CD 'syncWaves' allow you to assign a numerical value to resources, ensuring they are applied in the correct sequence.
What is an 'Image Updater' in the GitOps ecosystem?
This automates the image promotion process.
Why this answer
An Image Updater is a controller that automatically updates image tags in the Git repository when a new version is available in a registry.
When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?
The controller identifies drift between the cluster and the repository.
Why this answer
It means the live state of the resources in the cluster does not match the desired state defined in the linked Git repository.
You are troubleshooting a multi-cluster Argo CD deployment where the 'staging' cluster is healthy but 'production' cluster is 'OutOfSync' despite having the same manifest source. Why might this happen?
Manual changes cause drift, which Argo CD detects as 'OutOfSync' when it compares Git state to the actual cluster state.
Why this answer
Argo CD evaluates the state of the cluster against the Git definition. If a manual change or a different controller (like a Helm release) has altered the cluster state, the sync status will reflect a mismatch.
A team is transitioning to GitOps. Which action best aligns with the principle of Declarative Desired State?
This represents the desired state declaratively in version control.
Why this answer
Declarative configuration defines the end state, allowing tools to converge the system rather than executing imperative scripts.
Your organization uses a 'Git-branch-per-environment' strategy. You notice that hotfixes applied to the 'production' branch are being overwritten by automatic merges from the 'staging' branch. Which GitOps promotion pattern should you adopt to prevent this drift?
Using Kustomize overlays allows you to keep one branch as the source of truth, avoiding merge conflicts between environment branches.
Why this answer
The 'Pull Request based promotion' pattern ensures that changes are explicitly reviewed and merged from staging to production, rather than relying on automated long-running branch merges that cause conflicts.
Which statement best defines 'immutable state' in the context of GitOps?
Immutability in Git implies that the state associated with a commit should be permanent.
Why this answer
Once a configuration is committed to Git, that specific version of the state should remain unchanged in the repository.
An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?
Self-heal ensures live state matches Git state.
Why this answer
With self-heal enabled, ArgoCD detects the discrepancy between the live state and Git state and automatically overwrites the live state with the Git version.
During a blue-green deployment, what is the primary role of the traffic manager (e.g., Istio or Nginx Ingress)?
Traffic management enables controlled cutovers.
Why this answer
In blue-green deployments, the traffic manager performs the switch to route users from the old (blue) version to the new (green) version once validation is complete.
Why is 'Git' considered the 'source of truth' in GitOps?
Git holds the manifests that define what the system should look like.
Why this answer
Git provides a clear, immutable, and auditable history of every change made to the system, which is essential for reproducibility.
You are using Flux with Kustomize. You want to apply different configurations for production and staging, but both use the same base manifests. Which Kustomize feature allows this?
Overlays are the standard Kustomize method for environment-specific configs.
Why this answer
Kustomize overlays allow patching the base manifests with environment-specific configurations.
In a multi-cluster environment, how does the GitOps principle of 'Declarative Desired State' simplify cluster management?
Centralized declarations applied to multiple clusters ensure identical desired states.
Why this answer
It allows for a single source of truth that defines the state for multiple clusters, ensuring consistency across environments.
In a GitOps architecture, why is it critical that the entire state of the system is declarative?
Convergence requires comparing the desired declaration against the live state.
Why this answer
Declarative state allows the reconciliation loop to compare the current live state against the desired state defined in code, which is essential for automated drift correction.
Which THREE of the following items are commonly found in a Flux 'GitRepository' manifest?
Defines the version to track.
Why this answer
A GitRepository object defines the URL, the interval for polling, and the specific reference (branch or tag).
What is the primary function of an 'Admission Controller' in a GitOps-based DevSecOps workflow?
This prevents non-compliant resources from ever being created.
Why this answer
Admission controllers act as a final gate, validating or mutating requests to the Kubernetes API to ensure they comply with organizational policies.
A cluster is flagged as 'OutOfSync' in Argo CD. What does this status specifically indicate?
Argo CD compares the live cluster objects with the Git-defined objects; any difference triggers the OutOfSync status.
Why this answer
The OutOfSync status indicates that the live cluster state does not match the desired state defined in the Git repository.
Which THREE of the following are primary benefits of adopting GitOps for CI/CD integration?
Using the same deployment process across all environments reduces configuration drift.
Why this answer
GitOps improves auditability, disaster recovery, and operational consistency by centralizing the source of truth in Git.
Which THREE of the following are valid components or patterns used in Progressive Delivery with GitOps? (Select THREE)
AnalysisTemplates define the metrics to evaluate for a successful rollout.
Why this answer
Argo Rollouts, AnalysisTemplates, and blue-green deployments are all core components and patterns used to achieve progressive delivery within a GitOps ecosystem.
Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?
Flux is defined by these core controllers.
Why this answer
Flux v2 is architected around specialized controllers, including the Source Controller and Kustomization Controller.
A DevOps team is storing its Kubernetes manifests in a Git repository. To adhere strictly to the principle of versioned and immutable desired state in Git, how should the team manage changes to an existing deployment's container image tag?
Updating the manifest in Git creates a versioned, immutable record of the state change, allowing automated reconciliation.
Why this answer
GitOps principles require that the desired state stored in Git is versioned and immutable. Modifying the manifest in Git via a new commit or pull request creates a traceable, versioned audit trail. Directly mutating live cluster resources using kubectl violates the single source of truth principle.
When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?
The Git repo must be the authoritative reference for the system state.
Why this answer
Git serves as the single source of truth for the system's state, and using a repository allows for the application of standard software development practices like Pull Requests.
What is the impact of having multiple GitOps operators in the same cluster?
Two controllers trying to manage the same resource is a conflict.
Why this answer
Multiple operators can lead to resource contention and conflicting state management, which is generally discouraged.
Which TWO of the following are common challenges when implementing GitOps in an organization?
Legacy environments often have undocumented manual changes that must be reconciled.
Why this answer
Managing secrets and dealing with existing drift in legacy environments are significant hurdles in adopting GitOps.
Which TWO of the following are true about 'Pull' vs 'Push' deployment models?
This is the main architectural benefit of pull-based GitOps.
Why this answer
Pull is initiated by the cluster; Push is initiated by the external CI system.
In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?
Self-heal continuously monitors drift and applies Git state.
Why this answer
Self-healing or automated reconciliation is the GitOps mechanism that restores the cluster to the state defined in Git.
You are implementing progressive delivery using Flagger. After a Canary resource is defined, which metric is most critical for Flagger to automatically rollback a deployment during a blue/green shift?
Flagger specifically monitors service mesh or ingress metrics to decide if a traffic shift is safe.
Why this answer
Flagger uses analysis templates to evaluate Prometheus metrics; if the error rate or latency thresholds are exceeded, it triggers a rollback.
In GitOps, what is a 'Merge Request' (or Pull Request) used for?
This creates a collaborative and secure workflow.
Why this answer
The PR/MR process acts as a gatekeeping mechanism for reviewing and approving changes before they are merged into the main branch and applied to the cluster.
In an Argo CD 'Application' manifest, what does the 'destination' field specify?
Destination provides the target context for the sync operation.
Why this answer
The destination defines the cluster URL and namespace where the resources should be deployed.
When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?
Without unique tags, you cannot guarantee which version is actually running.
Why this answer
The 'latest' tag is mutable, meaning it can point to different code at different times, violating the GitOps principle of deterministic, reproducible deployments.
Which Argo CD feature allows you to manage multiple applications with shared configuration?
This is the intended use case for ApplicationSets.
Why this answer
Argo CD 'ApplicationSets' support templating, allowing you to define a base configuration and apply it across multiple applications dynamically.
Which of these is NOT a principle of GitOps?
Manual, imperative updates are the opposite of GitOps principles.
Why this answer
GitOps is inherently declarative; imperative commands violate the core principle of a defined desired state.
You are auditing your GitOps deployment strategy. Which TWO of the following statements correctly describe the 'Source of Truth' in a GitOps architecture?
This synchronization is the core goal of the GitOps model.
Why this answer
The Git repository is the canonical state, and the cluster is a reflection of that state.
Which TWO of the following are valid ways to configure an Argo CD 'Application'?
Argo CD Applications are Kubernetes objects.
Why this answer
Applications can be configured using Kubernetes manifests (YAML) or the CLI.
You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?
AppProjects define destination clusters and namespaces.
Why this answer
AppProject resources are used to group applications and define strict cluster and namespace-level destination restrictions.
In a multi-cluster GitOps architecture using Argo CD, how do you manage credentials for a remote cluster that is not the cluster where Argo CD resides?
This is the standard, secure way to register a remote cluster for GitOps management.
Why this answer
You must add the remote cluster's API server and authentication credentials to Argo CD using the 'argocd cluster add' command, which stores the secret in the Argo CD namespace.
What is the main advantage of using a 'Declarative' approach to system management?
This is the main benefit of declarative GitOps.
Why this answer
Declarative systems allow you to define 'what' the state should be, and the system automatically figures out the steps to get there, making it predictable and repeatable.
A company transitions from a push-based CI/CD pipeline (using Jenkins) to a pull-based GitOps model (using Flux). What is the primary security architectural change regarding cluster access?
Pull-based models allow the agent within the cluster to reconcile state, eliminating the need to expose cluster API credentials to external build systems.
Why this answer
In push models, the CI server requires cluster credentials. In pull models, the operator inside the cluster initiates the fetch, removing the need for external cluster-admin access.
When a manual change is made directly to a Kubernetes Service via 'kubectl edit', what behavior is expected from a properly configured GitOps operator set to 'Automatic Sync'?
This is the core definition of GitOps Self-Heal in tools like Argo CD and Flux.
Why this answer
If 'Self-Heal' is enabled in the GitOps operator, it will detect the drift caused by the manual 'kubectl edit' and overwrite the live change with the version defined in Git.
Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?
The cluster pulls from the repo, meaning no inbound ports need to be opened for the CI system.
Why this answer
Push-based systems require the CI/CD server to have cluster-admin credentials, whereas pull-based controllers use service accounts within the cluster.
Which TWO of the following are valid ways to trigger a sync in ArgoCD?
Manual triggered sync.
Why this answer
ArgoCD can be triggered via a manual UI action or through an automated webhook notification from a git provider.
You are using a 'Pull' based GitOps model (e.g., Flux or Argo CD). Why is it considered more secure than a 'Push' based CI/CD model?
The cluster manages its own authentication, increasing security.
Why this answer
In a Pull model, the cluster agent pulls changes from Git. The cluster does not need inbound firewall access from the CI/CD server, and no secrets are stored on the CI server.
Which THREE of the following are common methods for managing secrets in a GitOps workflow?
Syncs secrets from external stores like Vault.
Why this answer
Sealed Secrets, SOPS, and External Secrets Operator (or Vault) are the industry standards for secrets in GitOps.
You want to promote a microservice from staging to production using the 'Git Branch' strategy. Which configuration allows you to ensure the exact same container image SHA is used across both environments?
Keeping the chart constant and varying the values (including the image SHA) is the standard GitOps practice for promotion.
Why this answer
Using image tags like 'latest' is non-deterministic. Referencing the specific SHA in the Git manifest for the production branch ensures consistency.
Which THREE components are typically involved in a GitOps reconciliation loop?
The agent performing reconciliation.
Why this answer
The loop involves the Git source, the controller, and the cluster resources.
You are implementing progressive delivery with Flagger. You notice that the canary analysis is failing despite the new version being stable. What is the most common reason for this?
If Flagger cannot retrieve the metrics defined in the analysis template, it defaults to a failed state.
Why this answer
Flagger requires specific metrics (like HTTP request success rate) to be present to validate a canary. If the metrics provider (e.g., Prometheus) is not configured, the analysis cannot proceed.
You are using Flux and want to pause reconciliation for a specific application without deleting the resource. Which field should you modify?
This field stops the controller from reconciling the resource.
Why this answer
The 'suspend: true' field in the Kustomization or HelmRelease resource pauses reconciliation for that specific object.
You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?
The controller uses the private key stored in the cluster to decrypt secrets.
Why this answer
The Sealed Secrets controller running in the target cluster holds the private key required to decrypt the SealedSecret into a standard Kubernetes Secret.
You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?
Manual changes bypass Git, causing the cluster state to deviate from the desired state defined in Git.
Why this answer
Flux reconcilers periodically verify the cluster state; drift usually occurs when an external actor modifies the cluster directly or a manual change occurred.
How do you handle 'Environment-specific' configurations in a GitOps repository?
Overlays allow for shared code with specific environment overrides.
Why this answer
Using tools like Kustomization or Helm allows for managing common base configurations with environment-specific overlays.
When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?
This is the primary function of the sync policy.
Why this answer
The sync policy determines whether the cluster is updated automatically when drift is detected or if manual intervention is required.
You are configuring an Argo CD application. After a developer manually modifies a Kubernetes Service via kubectl, the application status changes to 'OutOfSync'. Which GitOps principle is this monitoring process specifically identifying?
The process of identifying discrepancies between the desired state in Git and the actual cluster state is known as drift detection.
Why this answer
The reconciliation loop continuously compares the live state with the desired state defined in Git, flagging manual changes as drift.
Your organization is transitioning from imperative scripts to Infrastructure as Code (IaC) using Terraform. You need to ensure that the infrastructure state remains synchronized with the Git repository after every commit. Which approach best aligns with GitOps principles?
GitOps controllers provide the continuous reconciliation loop required to keep infrastructure state in sync with Git.
Why this answer
GitOps requires a declarative source of truth where the current state of infrastructure is automatically reconciled against the desired state defined in Git.
Page 1 of 5
Page 2Practice CGOA by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →